Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2026-87874: Ansible memcached cache allows attacker code execution
CVE-2026-87874 · published 1 month ago
Summary
The memcached cache used by Ansible can accept data that it automatically runs when the cache is read. If a malicious user can access a shared or internet‑exposed memcached server, they can store specially crafted data that will be executed on the Ansible controller, giving them control of the system. Protect the cache by restricting network access to memcached or disabling the plugin, and apply any updates that address this behavior.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | red hat | red hat ceph storage 5 | All versions |
| – | red hat | red hat ceph storage 9 | All versions |
| – | red hat | red hat openstack platform 17.1 | All versions |
| – | red hat | red hat openstack platform 18.0 | All versions |
| Debian:12 | debian | ansible | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | ansible | All versions |
| Ubuntu:22.04:LTS | canonical | ansible-core | All versions |
Original advisory text
Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller
A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit serialization and relies on python-memcached, which pickles values on write and unpickles them on read. Because memcached is unauthenticated and cache keys are predictable, an attacker able to reach a network-exposed or shared memcached instance can write a crafted pickle payload that is deserialized and executed on the Ansible controller when the poisoned fact cache is next read, leading to remote code execution.
References
- https://security-tracker.debian.org/tracker/CVE-2026-87874 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-87874 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-87874 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-87874
- https://bugzilla.redhat.com/show_bug.cgi?id=2530995 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published9 Sep 2026
Updated4 Nov 2026
First seen9 Sep 2026
Sources
CVE-2026-87874 · NVD
CVE-2026-87874 · MITRE
DEBIAN-CVE-2026-87874 · OSV
UBUNTU-CVE-2026-87874 · OSV
Track software like this
Free during beta